1. Field
The present invention is related to data security and, more particularly, to double authentication of electronic communication.
2. Related Art
Often security of electronic documents associated with business and banking employ electronic signing of documents to assure their authenticity and assure that the person submitting the document is not an imposter. The known approaches for securing electronic documents often require a smart card (also known as chip card or integrated circuit card (“ICC”)) that contains a private key, the use of which is controlled with a personal identification number (“PIN”). In general, smart cards may provide identity documentation, authentication, data storage, and application processing. In operation, a public key corresponding to the private key exists such that any data encrypted with the private key can only be decrypted by the public key, likewise any data encrypted with the public key can only be decrypted with the private key. As an example, when a document needs an electronic signature, the smart card may be accessed with information derived from the document and then a code is generated. At a later time, the integrity of the document can be verified by use of the document, the code, and the corresponding public key. As such, in this example, the electronic signing of the document is actually electronically securing the document and not just simply adding an electronic signature that only represents the signature of a user as if, for example, the user had physically signed a paper document. At present, numerous companies provide smart card security equipment, such as, for example, CHIPDRIVE, DOTINDOTS, SMART SIGN PROJECT, TODOS DATA SYSTEM AB.
Unfortunately, while smart cards do provide a certain level of security, they are nonetheless susceptible to some modern types of security attacks. As an example, a known approach at attempting to breach smart cards includes the utilization of malware such as, for example, sykipot, which initially operates as a keystroke logger for recording a user's PIN number and then (when the smart card is still in place) it utilizes the recorded PIN to electronically sign data on behalf of the user without the knowledge of the user. As such, smart cards usually fail to protect documents from determined hackers and intelligence agencies. Moreover, another problem that exists with the use of smart cards is that the client has a direct communication with the smart card and, therefore, may access other information on the smart card without the knowledge, knowing consent, or both of the user of the smart card. Additional security problems also exist with smart cards that include the emulation of smart cards.
Furthermore, the actual operation of a given smart card may also provide insight to hackers regarding the types of encryption being employed by the smart card. An example of this type of hacker attack includes utilizing a differential power analysis that measures the precise time and electric current required for certain encryption or decryption operations. From these measurements, an attacker may deduce the on-chip private key utilized by a public key algorithm such as, for example, the Rivest, Shamir, and Adleman algorithm (“RSA”), one of the first practical public-key cryptosystems that is widely used for secure data transmission. Additionally, some implementations of symmetric ciphers may be vulnerable to timing or power attacks as well. Furthermore, smart cards may be physically disassembled by using acid, abrasives, or some other technique to obtain unrestricted access to the on-board microprocessor. Although such techniques involve a fairly high risk of permanent damage to the chip on the smart card, and irrecoverable loss of the secret keys therein, they nevertheless are capable of permitting the collection of much more detailed information.
As such, there is a need for a secure approach for electronically signing documents that prevents hackers from electronically signing documents unbeknownst to the authorized signer.